Add state param to OAuth /authorize request
#3
Conversation
When doing an OAuth `/authorize` request to an OAuth authorization server, include a `state` parameter, as described at https://support.okta.com/help/s/article/the-authentication-request-has-an-invalid-state-parameter?language=en_US This enables OAuth to work with Okta. Fixes: https://github.com/orgs/mcp-auth/discussions/44, modelcontextprotocol#442
msabramo
force-pushed
the
send-state-parameter-for-oauth-authorize-requests
branch
from
0a09986 to
091f68e
Compare
|
Hi @msabramo, thanks for your PR! I am currently considering syncing the mcp-auth fork of inspector with the official repo. Would you be open to submitting this PR to the official inspector repo as well? Of course, I will first merge this PR into the current project. I plan to do this after modelcontextprotocol#345 is merged. If there are further updates to the official inspector repo, would you be able to help keep things in sync there? Previously, I was syncing PRs from my personal fork to the official repo, so submitting PRs to the official repo directly from this project (mcp-auth) is a bit inconvenient. Thanks again for your contribution! |
You're welcome! I'm happy to contribute to the very nice work you've done here to make auth much easier in MCP and I'd be happy to submit this to the official repo tool so that even more people can benefit from it! I already have a few PRs in the official inspector repo: |
|
Hi @msabramo, some tests failed—could you take a look? |
Well, it looks like these same errors might be happening on https://github.com/mcp-auth/inspector/actions/runs/15085688162 Since I'm looking at it now, let me see if I can fix them and submit another PR for that. |
from apparently forgetting to add some new defaultProps ``` > @modelcontextprotocol/[email protected] build > tsc -b && vite build src/components/__tests__/Sidebar.test.tsx:44:10 - error TS2739: Type '{ connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 16 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 44 <Sidebar {...defaultProps} {...props} /> ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:185:12 - error TS2739: Type '{ bearerToken: string; transportType: "sse"; connectionStatus: "disconnected"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 15 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 185 <Sidebar ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:215:12 - error TS2739: Type '{ bearerToken: string; transportType: "sse"; connectionStatus: "disconnected"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 15 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 215 <Sidebar ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:379:12 - error TS2739: Type '{ env: Record<string, string>; setEnv: Mock<UnknownFunction>; connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<UnknownFunction>; ... 16 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 379 <Sidebar {...defaultProps} env={updatedEnv} setEnv={setEnv} /> ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:414:12 - error TS2739: Type '{ env: { NEW_KEY: string; }; connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<UnknownFunction>; command: string; setCommand: Mock<UnknownFunction>; ... 15 more ...; setConfig: Mock<...>; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 414 <Sidebar {...defaultProps} env={{ NEW_KEY: "test_value" }} /> ~~~~~~~ src/components/__tests__/Sidebar.test.tsx:599:12 - error TS2739: Type '{ config: InspectorConfig; setConfig: Mock<UnknownFunction>; connectionStatus: "disconnected"; transportType: "stdio"; setTransportType: Mock<...>; ... 16 more ...; loggingSupported: boolean; }' is missing the following properties from type 'SidebarProps': oauthClientId, setOauthClientId, oauthParams, setOauthParams 599 <Sidebar ~~~~~~~ Found 6 errors. ```
Hi @xiaoyijun, check out #4 |
2 participants
Add
stateparam to OAuth/authorizerequest; increases security and allows OAuth to work with OktaMotivation and Context
Some OAuth servers, such as Okta require the
stateparameter to be present to help prevent CSRF attacks.More info:
In particular, https://support.okta.com/help/s/article/the-authentication-request-has-an-invalid-state-parameter?language=en_US says:
How Has This Been Tested?
npm run devwhoamitoolBreaking Changes
Hopefully none
Types of changes
Checklist
Additional context
Cc: @xiaoyijun, @phuctm97, @jspahrsummers, @jerome3o-anthropic